LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NLinkedin Oncall
APPLinkedin≤ 1.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
Related vulnerabilities
CVE-2024-28425HIGH7.5ten sam vendor
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /...
CVE-2008-3435HIGH7.5ten sam vendor
LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not properly verify the authenticity of updates, which al...
CVE-2025-56139MEDIUM5.3ten sam vendor
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title...
CVE-2021-4264MEDIUM6.3ten sam vendor
A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue i...
CVE-2007-3955MEDIUM6.8ten sam vendor
Buffer overflow in the IEToolbar.IEContextMenu.1 ActiveX control in LinkedInIEToolbar.dll in the LinkedIn Tool...